ThreatConnect 5.8

ThreatConnect allows for informed decision-making based on the power of an organization’s threat intelligence. The ThreatConnect Platform offers easy, centralized management of security processes, data and threats. ThreatConnect connects all elements of a security team in one central platform, to gather information on threats and assist with the decision-making process. Organizations can deploy ThreatConnect in the cloud or on-premises. A multi-environment orchestration option aims at those looking to deploy across multiple environments. ThreatConnect has a designated engineering team to build new integrations.

ThreatConnect’s query language allows security teams to create and customize dashboards around data specific to an individual organization’s needs. They can use tracking and management features for team tasks as well as to enjoy the financial savings that using certain playbooks (automation capability) offers. The dashboard gives quick visibility into recently observed indicators of compromise and trending topics so analysts can train their focus where it’s needed.

The solution storyboards playbooks with hundreds of app choices to automate handling virtually any action an analyst would want to take. Every playbook starts when an app is triggered. Customers can create their own apps or modify existing options. Built-in Python development provides an option to create an app in this development area, rather than having to spin up a development environment, dramatically reducing overhead. It is designed to run inside ThreatConnect, making it easier to create apps. With multiple playbook servers, mission critical playbooks will always run accordingly.

The vendor clearly kept easy collaboration in mind through the design of the user interface, which offers commenting capability throughout for maximum team efficiency. The platform supports complex filtering capabilities with tags to categorize items around behavior, geography and an extensive array of other characteristics. Analysts also can collaborate within the details page of an incident report to make smarter decisions about handling issues. ThreatConnect is interested in creating an incident report, not just automating action, to improve analyst’s decision making. Detailed information with additional enrichments shows how an incident fits into the larger threat landscape. Other analysts can add insights for a truly comprehensive collaboration.

CAL, the Collective Analytics Layer, displays high-level, at-a-glance, reputation indicators from anonymous, crowdsourced intelligence. It aggregates and anonymizes telemetry information then sends it back to other instances of ThreatConnect in the form of information enrichments used to compare the number of observations of a compromise indicator against a global count to determine the likelihood of a targeted attack.

The platform supports several SIEM integrations, particularly Splunk, creating a bidirectional link between ThreatConnect and Splunk so threat intelligence is brought directly into Splunk where analysts can view threat summaries and other information.

Starting price is $100,000. Basic support is offered 8/5and is included in the product cost. Enhanced support is offered for 24/7 for 25 percent of the list price. Phone, email and website support are offered included FAQs and a knowledgebase. 

Tested by: Tom Weil